Tax Compliance Agent was building the pipes UAE e-invoices will have to flow through. Before it could go live, it had to clear an FTA security review. This is how it got there with Osto, and what it has built on since.
TL;DR
Tax Compliance Agent (TCA), a bootstrapped Dubai company founded by Kanishka Garg, builds e-invoicing infrastructure for the UAE’s new mandate. Its FTA security review flagged two gaps: its APIs needed active protection, and it needed formal security documentation to the regulator’s standard. Osto onboarded TCA onto WAF and CSPM within days and got the evidence in order. The FTA security review cleared, TCA launched, and the relationship has since grown into VAPT, code security and SOC 2 work.
Within days
WAF and CSPM live
Onboarded in time for the review, in the founder’s own words.
Review cleared
FTA security review passed
Both gaps closed, and TCA launched with the evidence the regulator asked for.
6 engagements
And counting
From two modules to VAPT, source code review, SAST and SOC 2.
When your product is the channel a country’s invoices will move through, the regulator does not take your security on trust. It asks to see it.
On this page
A new mandate, and new pipes
Under Ministerial Decisions 243 and 244 of 2025, the UAE is moving B2B and B2G invoicing onto a structured, Peppol-based electronic system. Businesses will not send e-invoices to the tax authority themselves. Every in-scope invoice passes through an accredited service provider, which validates it, transmits it to the buyer’s provider and reports the tax data onward.
| Phase | From | Who it covers |
|---|---|---|
| Voluntary adoption | 1 July 2026 | Businesses that choose to go early |
| Mandatory, first wave | 1 January 2027 | Businesses with annual revenue of AED 50 million or more |
| Mandatory, second wave | 1 July 2027 | All other in-scope businesses |
| Government entities | 1 October 2027 | In-scope government transactions |
The government is not building that layer itself. Approved providers build and run it, and the right to do so depends on satisfying the Ministry of Finance and the Federal Tax Authority that the platform can be trusted with regulated tax data. That is where TCA’s story starts.
What Tax Compliance Agent is
Tax Compliance Agent is a Dubai-based, AI-native e-invoicing company founded by Kanishka Garg. It describes its platform as FTA-accredited: businesses connect their ERP, get their invoice data into shape, and clear invoices through TCA’s Peppol-certified access point, hosted in the UAE.
| At a glance | Tax Compliance Agent |
|---|---|
| Founder | Kanishka Garg |
| Headquarters | Dubai, UAE |
| Funding | Bootstrapped |
| Product | UAE e-invoicing platform and Peppol access point, hosted in the UAE |
| Built for | Small and mid-sized businesses priced out of large enterprise e-invoicing suites |
The product covers the whole chain the mandate asks for: generating invoices in the structured format the government specifies, sending them over the Peppol network, reporting tax data, and storing the records securely for years. Every invoice a TCA customer sends passes through that infrastructure. A weakness there would be a tax data incident affecting every business on the platform, which is exactly why the regulator looks hard before letting a provider operate.
What the FTA security review flagged
TCA was in the middle of its application in early 2026 when the FTA security review came back with two gaps. Until both were closed, the platform it had built could not go live.
| Gap | Status | What had to be shown |
|---|---|---|
| API security | Required | Active protection in front of the APIs that receive invoice and tax data, blocking injection, credential stuffing and abuse before requests reach the application |
| Security documentation | Required | Formal policies and controls evidence in the shape government assessors expect, describing a programme that actually exists |
Small team, regulator-grade bar
TCA had built the product fast with a lean team and no in-house security function. The FTA security review was asking for what a much larger company would have taken months to procure and document, and the launch waited on it.
What Osto put in place
TCA came to Osto in January 2026 with two concrete asks: get real security running, and get the documentation ready to submit. Osto worked on both in parallel, because documentation only holds up in an FTA security review if it describes controls that are live.
A WAF in front of the invoice APIs. Osto’s web application firewall went in front of TCA’s application and API layer, inspecting every request and blocking known attack patterns and malicious payloads without any change to TCA’s code. That closed the API security gap the FTA security review had raised.
CSPM across the cloud. Cloud security posture management began scanning TCA’s environment for the misconfigurations that creep into fast-built infrastructure, such as public storage, over-permissive access, unencrypted databases and missing logging, and tracking each fix. For a platform holding regulated invoice records, that turns a potential regulatory event into a routine ticket.
Documentation built on real controls. Alongside the deployment, Osto produced the formal security documentation the FTA security review needed: policies, controls evidence and the structured material assessors look for, all describing what was now running in TCA’s stack.
“We are a registered e-invoicing vendor under the Federal Tax Authority of Dubai. Osto onboarded us onto WAF and CSPM within days, helped us get the required evidence in order, and we cleared the FTA review. Compliance certifications are next on the roadmap.”
Kanishka Garg, Founder, Tax Compliance Agent
The results
| Outcome | Status | What happened |
|---|---|---|
| FTA security review | Cleared | Both gaps closed with running controls and documentation, and TCA passed on submission |
| Launch | Live | TCA went to market as a UAE e-invoicing provider |
| WAF and CSPM | Running | In place before TCA onboarded its first paying customer, not bolted on afterwards |
The FTA security review is what everyone was watching. The more useful outcome is quieter. TCA’s customers now route their invoices through a platform whose security was built to a regulator’s standard from the first day it carried live data.
What happened after launch
Clearing the FTA security review was the condition for launching. It was never going to be the last security question. As more businesses route invoices through TCA, customers, auditors and the regulator all expect more, and the engagement has grown to meet that.
| Engagement | Status | What it covers |
|---|---|---|
| VAPT | Done | A structured test of TCA’s application and APIs |
| Source code review | Done | An assessment of the codebase behind the invoice pipeline |
| Code security with SAST | Ongoing | Continuous scanning so new code is checked as it ships, not once a year |
| SOC 2 | In progress | The first of the compliance certifications on TCA’s roadmap |
| Second VAPT | In progress | A fresh round of testing as the platform and its API surface grow |
The pattern is the one the review started: security that grows with the volume of data moving through the platform, run by one partner so the team stays on the product.
What other founders can take from this
The regulator is a buyer
Of your security
In regulated infrastructure, the licence to operate depends on a security review, and it arrives before revenue does.
Documents follow controls
Never the other way round
Assessors test what the paperwork says. Deploy first, then write down what is running.
Launch is the start
Of the security roadmap
Testing, code scanning and certification follow as volume grows. Planning for that early keeps each step small.
How Osto supports regulated launches
Osto is one platform built and run in one stack: web and API protection, cloud posture, endpoint, penetration testing, code security with SAST and SCA, and compliance automation for SOC 2, ISO 27001 and more than 200 frameworks. For a company facing an FTA security review or any other regulator’s assessment, that means the controls and the evidence come from the same place, and the answers to a security questionnaire or an assessor’s follow-up are already there.
Osto is not the regulator or the accrediting body. It makes sure that when the review happens, there is real security to show. The certificate is a byproduct of the security, not the other way around.
Platform walkthrough
Launch with the security review already behind you
Osto deploys the controls and builds the evidence from them, so a regulator’s review finds a programme that is already running.
Book a demoOne platform, everything · Security without slowing down
Frequently asked questions
What did TCA’s FTA security review flag?
Two gaps. TCA’s API infrastructure needed active security protection in place, and it needed formal security documentation that met the regulator’s standard. Osto closed the first with a web application firewall and cloud posture management, and produced the documentation from those running controls.
When does UAE e-invoicing become mandatory?
Voluntary adoption opens on 1 July 2026. It becomes mandatory from 1 January 2027 for businesses with annual revenue of AED 50 million or more, from 1 July 2027 for other in-scope businesses, and from 1 October 2027 for government entities. Every in-scope invoice must go through an accredited service provider.
What security do UAE e-invoicing providers need to show?
Accreditation sits with the Ministry of Finance and the Federal Tax Authority and covers technical, security and data requirements, including Peppol certification and hosting tax records appropriately. In practice that means protected APIs, a clean cloud environment and documented controls. Certification requirements are set out in Ministerial Decision No. 64 of 2025 and should be checked against its current text.
Why was WAF and CSPM the right starting point for an e-invoicing platform?
Because the two biggest exposure points are the APIs receiving invoice data and the cloud environment storing it. A WAF blocks attacks on the first before they reach the application, and CSPM catches misconfigurations in the second continuously. Both produce the kind of evidence an FTA security review asks for.
Does Osto accredit e-invoicing providers?
No. Accreditation is granted by the UAE authorities. Osto deploys the security controls and prepares the evidence a provider needs, so that when the FTA security review or any other assessment happens, there is a real, running programme to show.
